2

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt to brute force accounts and enumerate users, and detect DDoS against the web app?

Snort can be installed on the Linux based loadbalancers (haProxy); but I am not sure where commercial tools like Alert Logic should sit that does not create a performance bottleneck and single point of failure.

|improve this question
2

I don't have much experience with AWS, but if your main goal is to protect against web-related exploits like XSS, SQL injection, etc., then a web application firewall may be more effective. Snort certainly has rules available for these things, but in my experience a web application firewall will do a better job. This thread has a good explanation on why this is often the case: Using an IPS as an alternative to mod_security

If you are using apache mod_security is the most popular WAF. For DDoS and brute force protection, check out mod_evasive.

Of course Snort does a pretty good job as well and protects against things that WAFs do not, so if the extra resource usage doesn't concern you then I don't think there's any harm in also running Snort as an additional layer of protection.

Ultimately though, the best way to secure a web application is to audit the web site's source code to make sure that these vulnerabilities don't exist in the first place. IDS and web application firewalls are great, but if your site has a vulnerability, a determined attacker will find a way to exploit it.

|improve this answer
  • Very interesting suggestions. My concerns comes from the fact that everyday through application logs, I see from many malicious IPs we get a considerable load of traffic trying XSS and SQL injection; they do not succeed, but I would like to detect it, and just block those IPs automatically. Is mod_security a good choice for this? – Goli E Dec 31 '14 at 17:48
  • @GoliE mod_security will block attacks before they reach the application, but I don't believe it provides a built-in mechanism for banning IP addresses. There are, however, a number of ways to do it which you can find on Google. The simplest way I've found is to combine it with the excellent tool fail2ban: fail2ban.org/wiki/index.php/HOWTO_fail2ban_with_ModSecurity2.5 – tlng05 Dec 31 '14 at 20:01
  • One other thing that I forgot to mention in my original answer: If any pages on your website use HTTPS, Snort will not be able to detect attacks on those pages, while mod_security will. This is because Snort only monitors network packets and therefore cannot read HTTPS encrypted data, whereas mod_security has access to transaction data before SSL encryption and after SSL decryption. – tlng05 Dec 31 '14 at 20:14
  • Thanks @user54791, well; if I terminate SSL traffic on the load balancer, then I can pass it through Snort.right? – Goli E Dec 31 '14 at 21:19
  • @GoliE, yes, if you terminate on the load balancer and put the Snort machines behind the load balancer, then Snort will be able to monitor the SSL traffic. – tlng05 Dec 31 '14 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.